Authentication Bypass in ZITADEL 3.x and 4.x by ZITADEL

CVE-2026-109372

What is CVE-2026-109372?

ZITADEL versions 3.4.15 and earlier in the 3.x series, along with all 4.x versions prior to 4.19.2, are susceptible to an authentication bypass due to a flaw in the SAML identity provider's intent callback mechanism. This vulnerability occurs when the assertion signature verification process incorrectly matches the user to an incoming request without ensuring that the specified provider aligns with the expectations. Malicious users with organization-administrator rights can leverage this exploit by registering a SAML provider, employing their own signing key, which allows them to create authenticated sessions as any user linked to a different SAML provider within the same instance. This issue raises significant security concerns, particularly with account takeover possibilities across different organizations utilizing ZITADEL.

References